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Mr.  Chairman  and  Members  of  the  Subcommittee: 

Thank  you  for  the  opportunity  to  appear  before  your  Committee  today  and  address  your 
questions  regarding  controls  over  disposal  of  DoD  surplus  equipment  and  controls  over 
select  biological  agents.  I  share  your  concerns  that  terrorists  or  extremist  groups  might 
use  surplus  DoD  biological  equipment  and  agents  to  produce  weapons  of  mass 
destruction  against  United  States  citizens.  Today  I  want  to  present  the  results  of  an 
“Interagency  Summary  Report  on  Security  Controls  Over  Biological  Agents”  (Report 
No.  D-2003-126). 

The  August  27,  2003,  report  consolidates  issues  identified  in  27  reports  published  by  the 
Offices  of  the  Inspectors  General  of  the  Departments  of  Agriculture,  Army,  Defense, 
Energy,  Health  and  Human  Services,  and  Veterans  Affairs.  The  summary  report 
identified  nine  systemic  problems:  physical  security,  personnel  access  controls, 
inventory  accountability  and  controls,  contingency  plans,  registration  with  the  Centers  for 
Disease  Control  and  Prevention  (CDC),  import  and  export  of  agents,  safety  and  security 
training,  management  oversight,  and  policies  and  procedures.  We  are  pleased  to  report 
that  corrective  actions,  as  recommended  in  the  27  reports,  were  initiated  by  those 
agencies. 

I  will  also  discuss  the  problems  that  we,  the  Office  of  the  Inspector  General,  Department 
of  Defense,  like  the  General  Accounting  Office,  have  identified  with  controls  over  the 
disposal  of  DoD  surplus  equipment. 

Interagency  Summary  Report 

Deficiencies  in  security  controls  have  serious  implications  for  the  health  of  United  States’ 
citizens,  should  those  controls  be  breached  and  biological  agents  removed  from  the 
facility.  Subsequent  misuse  of  the  biological  agents  could  have  serious  health 
consequences  and  disrupt  the  country’s  agriculture,  commerce,  economy  and,  industry. 

Biological  Agents 

Biological  agents  are  micro-organisms,  or  their  toxins,  that  cause  or  may  cause  human, 
animal,  or  plant  diseases.  Such  disease-causing  biological  agents  are  termed  pathogens. 
Select  agents  are  pathogenic  biological  agents  specifically  described  as  having  the  potential 
to  pose  a  severe  threat  to  public  or  agricultural  health  and  safety.  For  instance,  anthrax 
( Bacillus  anthracis),  smallpox  (Variola  major),  and  the  Ebola  viruses  are  considered  select 
agents  by  the  CDC,  while  foot-and-mouth  disease  virus  and  classical  swine  fever  virus  are 
considered  select  agents  by  the  Department  of  Agriculture.  The  CDC  has  identified 
36  biological  agents  as  select  agents  due  to  their  potentially  devastating  effect  on  human 
populations.  Correspondingly,  the  Department  of  Agriculture  has  identified  an  additional 


1  Spore-forming  bacterium  that  causes  anthrax. 
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33  biological  agents  as  posing  a  threat  to  U.S.  agricultural  livestock  or  crop  commodities. 
Because  various  Federal  agencies,  contractors,  and  universities  maintain  laboratories  with 
biological  agents  to  support  biological  defense  programs,  medical  research,  and  clinical 
diagnostic  testing,  the  CDC — in  conjunction  with  the  National  Institutes  of  Health — 
provides  guidelines  for  categorizing  laboratory  safety  risks  into  four  biosafety  levels 
(BSLs),  with  BSL-4  being  the  highest  risk.  As  of  March  2002,  there  were  more  than 
275  facilities  registered  with  the  CDC  to  transfer  or  receive  biological  select  agents. 

Physical  Security 

Of  the  27  reports,  24  addressed  the  adequacy  of  physical  security  controls  over  biological 
agents,  23  of  which  cited  one  or  more  weaknesses  in  the  controls.  Physical  security 
controls  include  the  use  of  physical  barriers;  the  use  of  video  camera  surveillance, 
intrusion  detection  systems,  and  security  guards;  and  controlling  physical  access  to 
facilities  and  laboratories  where  agents  are  used  or  stored.  For  example,  17  of  the 
23  reports  cited  the  lack  of  adequate  controls  over  freezers  or  units  used  to  store 
biological  select  agents,  and  14  reports  identified  that  facilities  where  laboratories  were 
located  either  did  not  have  intrusion  detection  systems  or  had  physical  barriers  that  were 
easily  bypassed.  In  addition,  several  reports  cited  facility  entry  systems  that  could 
potentially  allowed  unauthorized  personnel  to  enter  by  simply  following  behind 
authorized  personnel. 

Figure  1  shows  an  open  and  accessible  biological  agent  storage  room  located  in  a  hallway 
outside  the  laboratory. 


Figure  1.  Open  and  Accessible  Biological  Agent  Storage  Room 
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Figure  2  shows  a  BSL-3  laboratory  inside  an  aging  trailer  that  is  equipped  with  a  hitch 
and  wheels,  but  not  with  adequate  security  devices. 


Figure  2.  BSL-3  Research  Laboratory  Housed  in  Mobile  Trailer 

Figure  3  shows  open  access  to  two  different  research  facilities. 


Figure  3.  Open  Access  to  Research  Facilities 

Personnel  Access  Controls 


Personnel  access  controls  were  addressed  in  25  of  the  27  reports,  23  of  which  identified 
weaknesses  in  the  controls.  Personnel  access  controls  include  the  use  of  identification 
badges,  keys,  logbooks,  and  background  investigations.  Personnel  access  controls  are 
necessary  to  preclude  unauthorized  personnel,  including  restricted  persons  identified  in 
the  USA  PATRIOT  Act,  trom  obtaining  access  to  or  possession  of  biological  select 
agents.  Access  weaknesses  found  included  lack  of  access  restrictions  for  maintenance 
and  repair  personnel  and  foreign  nationals  (researchers  and  students). 


Restricted  persons  include  felons  or  those  indicted  for  felonies,  unlawful  users  of  a  controlled  substance,  those 
dishonorably  discharged  from  the  U.S.  Armed  Forces,  individuals  adjudicated  as  mentally  defective,  illegal  aliens, 
and  non-resident  foreign  nationals  of  countries  supporting  international  terrorism.  As  of  May  21,  2002,  the 
Secretary  of  State  had  designated  the  governments  of  seven  countries  as  state  sponsors  of  international  terrorism: 
Cuba,  Iran,  Iraq,  Libya,  North  Korea,  Sudan,  and  Syria. 


4 


Some  laboratories  gave  employees  access  to  biological  agents  pending  the  results  of 
background  investigations,  and  other  laboratories  allowed  access  by  personnel  with  no 
background  investigation  at  all. 

Inventory  Accountability  and  Controls 


Of  the  27  reports,  24  addressed  inventory  accountability  and  controls,  with  23  of  the 
reports  identifying  weaknesses  in  the  inventory  controls.  Inventory  controls  include 
storage,  transfer,  record  keeping,  and  destruction  of  biological  agents.  The  most  frequent 
inventory  control  weaknesses  were  poor  record  keeping  and  the  lack  of  inventory  control 
systems.  For  example,  an  agency  report  stated  that  of  62  locations  required  to  keep 
inventories  of  chemical  and  biological  agents,  only  39  did,  and  only  22  updated  their 
inventories  annually.  As  a  result,  one  laboratory  unknowingly  continued  to  maintain 
Salmonella,  and  an  inaccurate  inventory  at  another  location  resulted  in  the  Secretary  of 
the  agency  misreporting  to  the  Department  of  Homeland  Security  that  the  location  was 
not  using  BSL-3  agents,  when  in  fact  it  was  storing  and  experimenting  with  Bluetongue 
virus  and  Vesicular  stomatitis  virus,  both  classified  as  BSL-3  agents  by  the  Department 
of  Agriculture. 

Another  agency’s  inventories  were  not  reliable  because  of  the  various  ways  researchers 
introduced  biological  agents  into  facilities,  including  the  purchase  of  biological  agents 
from  private  vendors  over  the  telephone  using  personal  or  Government  credit  cards. 
Vendors  generally  sent  the  agents  directly  to  the  individual  researcher.  In  addition, 
researchers  could  independently  reproduce  cultures,  and  records  showing  such  culture 
increases  did  not  always  exist.  The  report  also  stated  that  it  was  a  common  practice  to 
informally  share  specimens  with  colleagues  at  other  facilities  and  that  such  exchanges 
were  not  always  documented.  For  example,  at  one  facility,  a  researcher  purchased 
17  containers  of  virulent  anthrax  in  1993  from  a  private  vendor,  then  later  gave  the 
anthrax  to  a  colleague  at  another  facility  because  his  own  project  was  canceled.  He  and 
his  colleague  decided  not  to  register  the  purchase  or  the  transfer  with  CDC  because  they 
held  academic  appointments  at  affiliated  universities. 

Contingency  Plans 

Of  the  27  reports,  9  reviewed  and  addressed  weaknesses  in  contingency  plans  that  relate 
to  security  controls  over  biological  agents  and  the  facilities  that  house  the  agents. 
Contingency  plans  document  rapid  responses  and  special  procedures  to  ensure  the  safety 
and  readiness  of  personnel,  equipment,  and  facilities  in  response  to  major  emergencies 
caused  by  natural  disasters,  terrorists,  or  subversives.  The  following  are  some  examples 
of  the  problems  cited  in  the  reports. 


One  agency  could  not  perform  a  vulnerability  assessment  because  the  agency  lacked  a 
consolidated  database  to  track  the  types  and  locations  of  agents  stored  and  used. 
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Several  reports  cited  the  lack  of  up-to-date  contingency  plans,  contingency  plans  for 
missing  agents,  or  contingency  plans  for  power  disruptions.  For  example,  a  laboratory 
experienced  regular  power  outages  and  critical  system  problems,  including  swipe  card 
access  disruptions.  Thus,  during  power  disruptions,  the  doors  would  remain  unsecured 
until  power  was  restored,  resulting  in  the  security  of  the  facility  being  compromised. 

CPC  Registration 

Nine  of  the  27  reports  addressed  CDC  registration,  of  which  five  identified  weaknesses. 
Facilities  that  ship  or  receive  biological  select  agents  are  required  to  register  with  the 
CDC,  in  accordance  with  the  Code  of  Federal  Regulations  (C.F.R.),  Title  42, 

Section  72.6.  The  purpose  of  the  registration  process  is  to  ensure  that  biological  agents 
are  shipped  only  to  facilities  with  laboratories  designed  to  handle  the  select  agents  and 
with  a  legitimate  reason  for  possessing  the  agents.  Problems  with  CDC  registration 
included  laboratories  that  did  not  know  which  agents,  such  as  non-virulent  agents, 
required  CDC  registration,  and  one  laboratory  did  not  comply  with  CDC  transfer 
requirements  because  it  was  unaware  of  the  existence  of  biological  select  agents  in  its 
facility.  In  December  2002,  42  C.F.R.  Section  72.6  was  augmented  by  42  C.F.R.  Part  73, 
“Possession,  Use,  and  Transfer  of  Select  Agents  and  Toxins.”  Part  73  adds  the 
requirement  that  facilities  that  already  possess  biological  select  agents  but  have  never 
registered  with  the  CDC  to  do  so. 

Import  and  Export  of  Agents 

Of  the  27  reports,  3  reviewed  and  addressed  concerns  with  the  import  and  export  of 
pathogens  and  select  agents.  Imported  plants,  plant  products,  and  animals  are  regulated 
through  U.S.  Department  of  Agricultural  permits  to  protect  the  Nation’s  population  and 
food  supply.  Concerns  about  the  import  of  pathogens  was  addressed  by  one  agency, 
which  stated  in  its  report  that  its  components  lacked  a  system  to  track  the  number  of 
shipments  entering  the  country  under  any  individual  import  permit  or  to  ensure  that  any 
incoming  shipment  is  actually  associated  with  a  valid  import  permit. 

Certain  biological  agents  and  related  technology  are  export-controlled  in  support  of 
U.S.  foreign  policy  opposing  the  proliferation  and  illegal  use  of  biological  weapons.  The 
Department  of  Commerce  maintains  a  listing  of  export-controlled  biological  agents  and 
export  licensing  requirements  in  its  Export  Administration  Regulations.  Concerns  about 
the  export  of  biological  select  agents  included  shipping  biological  agents  without 
determining  whether  an  export  license  was  required  and  inadequate  documentation  and 
reporting  of  biological  agent  shipments,  as  required  by  the  Export  Administration 
Regulations. 

Safety  and  Security  Training 

Of  the  27  reports,  9  reviewed  and  identified  training  weaknesses.  Training  is  essential 
not  only  to  remind  employees  of  routine  day-to-day  preventative  measures  they  can  take, 
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but  also  to  reinforce  management  emphasis  on  security.  For  example,  personnel 
controlling  access  to  one  facility  had  received  no  security  response  training.  At  another 
location,  security  personnel  were  not  aware  that  biological  agent  material  was  being 
stored  at  the  facility.  Personnel  at  other  facilities  were  not  trained  on  which  biological 
agents  were  export-controlled. 

Management  Oversight 

Of  the  27  reports,  14  addressed  the  adequacy  of  management  oversight,  13  of  which 
identified  management  oversight  as  a  contributing  factor  to  the  inadequate  controls  over 
biological  agents.  Management  oversight  is  key  to  ensuring  that  employees  are  aware  of 
and  are  taking  responsibility  for  the  security  of  biological  agents  and  the  facilities  that 
use,  store,  maintain,  or  transfer  the  agents.  The  areas  of  management  oversight 
weaknesses  identified  included  accountability,  biosecurity,  and  development  of 
contingency  plans.  For  example,  at  one  laboratory,  management  emphasis  and  oversight 
focused  on  bio -safety  for  laboratory  personnel  rather  than  on  bio -security.  At  another 
location,  senior  safety,  security,  and  management  officials  were  unaware  that 
experiments  with  biological  agents  were  conducted  at  their  laboratories. 

Policies  and  Procedures 


The  major  contributing  factor  for  inadequate  controls,  according  to  25  of  the  27  reports, 
was  the  lack  of  or  need  for  improved  policies  and  procedures  in  the  areas  of  physical 
security,  personnel  access,  inventory  management  and  training.  The  most-mentioned 
deficiency  related  to  the  need  to  improve  policies  and  procedures  to  control  personnel 
access  and  to  preclude  access  by  restricted  persons. 

Management  Corrective  Actions  Initiated 

Senior  management  at  each  of  the  six  agencies  have  initiated  corrective  actions  to 
improve  security  controls  over  biological  agents  in  response  to  the  individual  agency 
reports.  For  example,  the  Secretary  of  one  agency  initiated  a  task  force  to  develop 
policies  and  procedures  addressing  four  key  controls:  physical  security,  personnel 
security,  inventory  control,  and  biosecurity  incident  response.  In  another  agency,  senior 
officials  assigned  a  full-time  staff  officer  to  establish  a  biological  agent  security  program 
and  issued  interim  guidance  on  safeguarding  select  agents  and  on  export  controls  over 
biological  agents.  Another  agency  established  an  informational  Web  site,  which  includes 
standardized  procedures;  another  initiated  followup  actions  to  determine  the  status  of 
actions  taken  on  the  agency’s  report  recommendations. 
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Controls  Over  Disposal  of  Surplus  Equipment 

Like  the  General  Accounting  Office  has  reported,  we,  the  Inspector  General  of  the 
Department  of  Defense,  have  identified  problems  with  controls  over  the  disposal  of  DoD 
surplus  equipment. 

Report  No.  D-2003-101,  “Law  Enforcement  Support  Office  Excess  Property  Program,” 
June  2003,  states  that  the  Defense  Reutilization  and  Marketing  Service  (DRMS)  was 
distributing  DoD  excess  property  to  law  enforcement  agencies  without  the  accountability 
necessary  to  ensure  that  the  property  was  properly  and  appropriately  transferred.  We 
reviewed  148  DRMS  excess  property  transactions  related  to  the  Law  Enforcement 
Support  Office  Excess  Property  Program  and  found  that  45  percent  (66  transactions)  had 
undocumented  differences  between  the  quantities  of  property  approved  for  release  and 
the  quantities  issued  to  the  law  enforcement  agency  by  DRMS;  21  percent 
(31  transactions)  had  missing  approval  records;  and  8  percent  (12  transactions)  had  data 
entry  errors  in  the  approval  records.  For  example,  office  furniture  issued  by  a  DRMS 
office  located  in  New  Mexico  to  a  law  enforcement  agency  had  an  acquisition  value  of 
$5,400.  The  approved  request  was  for  office  furniture  valued  at  $600.  There  was  no 
documentation  available  to  support  the  reason  for  the  increased  quantity.  Both  the  Law 
Enforcement  Support  Office  and  DRMS  have  ongoing  initiatives  to  improve  visibility 
and  accountability  of  DoD  excess  property.  The  Law  Enforcement  Support  Office, 
working  with  DRMS,  planned  to  fully  implement  an  automated  requisition,  approval,  and 
issuance  process  by  October  2003.  DRMS  was  in  the  process  of  developing  digital 
storage  of  source  documentation  to  improve  visibility  and  accountability  of  property 
transfers. 

Summary 


Federal  agencies,  contractors,  and  universities,  as  holders  of  biological  agents,  have  a 
responsibility  to  ensure  the  security  of  biological  agents.  We  recognize  that 
implementing  security  controls  over  biological  agents  will  impact  the  open  nature  of  the 
research  community  and  careful  consideration  is  necessary  before  any  such  controls  are 
implemented.  However,  appropriate  security  controls  over  biological  agents  are 
imperative  in  today’s  environment.  Without  security  controls  and  sufficient  emphasis  on 
security,  biological  agents  at  Federal,  contractor,  and  university  laboratories  are 
vulnerable  to  theft  or  misuse.  Senior  officials  at  each  agency  have  taken  actions  to 
improve  security  controls  over  biological  agents  in  response  to  the  published  reports,  but 
continued  vigilance  is  needed. 

Thank  you  for  considering  the  views  of  the  various  Inspectors  General  on  these  critical 
issues.  This  concludes  my  testimony. 


